Crash in OOM | unknown | js::AutoEnterOOMUnsafeRegion::crash | js::jit::MBasicBlock::addPredecessorSameInputsAs

RESOLVED FIXED in Firefox -esr60

Status

()

defect
P2
normal
RESOLVED FIXED
Last year
Last year

People

(Reporter: lovecs0079, Assigned: nbp)

Tracking

({crash})

59 Branch
mozilla61
x86_64
Windows 10
Points:
---

Firefox Tracking Flags

(firefox-esr52 wontfix, firefox-esr60 fixed, firefox59 wontfix, firefox60 fixed, firefox61 fixed)

Details

(crash signature)

Attachments

(1 attachment)

Reporter

Description

Last year
This bug was filed from the Socorro interface and is
report bp-41a47bd8-d567-4535-a6bc-65f841180322.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll js::AutoEnterOOMUnsafeRegion::crash js/src/jscntxt.cpp:1651
1 xul.dll js::jit::MBasicBlock::addPredecessorSameInputsAs js/src/jit/MIRGraph.cpp:1169
2 xul.dll UpdateTestSuccessors js/src/jit/IonAnalysis.cpp:773
3 xul.dll MaybeFoldConditionBlock js/src/jit/IonAnalysis.cpp:893
4 xul.dll js::jit::OptimizeMIR js/src/jit/Ion.cpp:1480
5 xul.dll js::jit::CompileBackEnd js/src/jit/Ion.cpp:1980
6 xul.dll js::HelperThread::handleIonWorkload js/src/vm/HelperThreads.cpp:1908
7 xul.dll js::HelperThread::threadLoop js/src/vm/HelperThreads.cpp:2297
8 xul.dll js::detail::ThreadTrampoline<void  js/src/threading/Thread.h:235
9 ucrtbase.dll thread_start<unsigned int > 

=============================================================
Status: UNCONFIRMED → NEW
Component: General → JavaScript Engine: JIT
Ever confirmed: true
Product: Firefox → Core
Assignee

Comment 1

Last year
This bug sounds easily fixable by making addPredecessorSameInputAs fallible by using the Result type.
Flags: needinfo?(nicolas.b.pierron)
Priority: -- → P2
Attachment #8969301 - Flags: review?(tcampbell) → review+
Assignee

Updated

Last year
Flags: needinfo?(nicolas.b.pierron)
Keywords: checkin-needed
Assignee: nobody → nicolas.b.pierron
Keywords: crash

Comment 3

Last year
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/131166cff47d
Make MBasicBlock::addPredecessorSameInputsAs fallible. r=tcampbell
Keywords: checkin-needed

Comment 4

Last year
Pushed by sfink@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d9f508d0e46e
followup, remove now-unused variable to fix a CLOSED TREE.

Comment 5

Last year
bugherder
https://hg.mozilla.org/mozilla-central/rev/131166cff47d
https://hg.mozilla.org/mozilla-central/rev/d9f508d0e46e
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Whether we ship this in Fx60 or not, I'd like to keep this on the radar for possible ESR60 uplift eventually since the crash volume looks non-trivial.
Flags: needinfo?(nicolas.b.pierron)
Assignee

Comment 7

Last year
(In reply to Ryan VanderMeulen [:RyanVM] from comment #6)
> Whether we ship this in Fx60 or not, I'd like to keep this on the radar for
> possible ESR60 uplift eventually since the crash volume looks non-trivial.

Yes, these patches should be safe to uplift, and remove ~175 crashes/week when it moves to release.

(In reply to Pulsebot from comment #4)
> Pushed by sfink@mozilla.com:
> https://hg.mozilla.org/integration/mozilla-inbound/rev/d9f508d0e46e
> followup, remove now-unused variable to fix a CLOSED TREE.

Thanks.
Flags: needinfo?(nicolas.b.pierron)
Assignee

Comment 8

Last year
Comment on attachment 8969301 [details] [diff] [review]
Make MBasicBlock::addPredecessorSameInputsAs fallible.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1028580
[User impact if declined]: Unlikely crashes on OOM.
[Is this code covered by automated tests?]: No, not easy to cover error handling code.
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]:  No
[List of other uplifts needed for the feature/fix]: (both patches from this bug)
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Usage of MOZ_MUST_USE and simple patch.
[String changes made/needed]: None.
Attachment #8969301 - Flags: approval-mozilla-beta?
Comment on attachment 8969301 [details] [diff] [review]
Make MBasicBlock::addPredecessorSameInputsAs fallible.

Fix for OOM crash, let's uplift for beta 15.
Attachment #8969301 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.